All Apps and Add-ons

Azure Add-on doesn't get past initialization

gordo32
Communicator

I've configured the Azure Add-on (2.0) on Splunk Enterprise 8.0.2, but it doesn't appear to be getting past initialization. In debug mode, I just get:

2020-03-14 00:00:16,223 INFO pid=1832 tid=MainThread file=connectionpool.py:new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1
2020-03-14 00:00:16,917 INFO pid=1832 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1
2020-03-14 00:00:17,504 INFO pid=1832 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1
2020-03-14 00:00:18,467 INFO pid=1832 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1
2020-03-14 00:00:19,477 DEBUG pid=1832 tid=MainThread file=base_modinput.py:log_debug:286 | _Splunk
Getting proxy server.
2020-03-14 00:00:19,478 INFO pid=1832 tid=MainThread file=setup_util.py:log_info:114 | Proxy is not enabled!
2020-03-14 00:00:19,478 INFO pid=1832 tid=MainThread file=client_abstract.py:init:161 | u'eventhub.pysdk-ea3d48b9': Created the Event Hub client
2020-03-14 00:00:19,478 DEBUG pid=1832 tid=MainThread file=message.py:init:109 | Deallocating 'AMQPValue'
2020-03-14 00:00:19,479 DEBUG pid=1832 tid=MainThread file=message.py:init:109 | Destroying 'AMQPValue'
2020-03-14 00:00:19,480 DEBUG pid=1832 tid=MainThread file=client.py:open:234 | Opening client connection.
2020-03-14 00:00:19,480 DEBUG pid=1832 tid=MainThread file=init.py:initialize:157 | Initializing platform.
...lather, rinse, repeat...

Nothing in python.log either.

I configured my connection string as: Endpoint=sb://.servicebus.windows.net/;ShareAccessKeyName=RootManageShareAccessKey;SharedAccessKey=

Event Hub Name:
adlogs

Index:
eventhub

All other settings are defaults.

I've gone through the Azure config and all looks good as well. Any ideas why it would stop after "initializing platform" with no errors and then just restart on the next interval?

jawaharas
Motivator

As per Microsoft Azure Add on for Splunk's documentation, the add-on is compatible to below versions. When I tried the add-on (EventHub data-input) in Splunk Enterprise 7.2.9.1, its works.

COMPATIBILITY:
Products: Splunk Enterprise, Splunk Cloud
Splunk Versions: 7.3, 7.2, 7.1, 7.0

jawaharas
Motivator

Same here. Any assistance will be helpful.

0 Karma
Get Updates on the Splunk Community!

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

The Splunk Community Dashboard Challenge is still happening, and it's not too late to enter for the week of ...

Join Us at the Builder Bar at .conf24 – Empowering Innovation and Collaboration

What is the Builder Bar? The Builder Bar is more than just a place; it's a hub of creativity, collaboration, ...

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...